The use of electronic transactions and transmissions has proliferated with the advent of personal computers, or “terminals”, and improved communications networks such as the Internet. Billions of electronic transactions and transmissions are sent and received each year in the United States. An electronic transmission, as used herein, is defined as the accessing, processing, or presentation of electronic data, to include word-processed content, mathematical spreadsheets, emails, visual or graphic images, audible content, software code, pattern data, execution commands, computer software programs, Internet web sites, software rule modules, electronic instant messaging, and the like. An electronic transaction is any financial exchange, such as a debit, credit, stored value or electronic check.
A result of the significant popularity of electronic transactions and transmissions has been a marketplace transition from using an off-line, individual desktop personal computing model to using an on-line, central-server communications model. Specifically, corporations and individual consumers are moving the main functions of storage, access, processing and presentation of their electronic transactions and transmissions from decentralized, unconnected desktop terminals, to centralized databases on servers which service and connect to on-line PCs, known as “client terminals”, via dial-up, leased lines or wireless networks. In this transition, such client terminals are also increasingly being connected to each other. An integrated web of communications is forming that enormously expands the functions and benefits of using such clients, evidenced by fast growth of the Internet.
At the same time, cost reductions in miniaturizing computer hardware components have led to the widespread use of a new generation of computing devices, known herein as “thin-clients”, which are even less expensive and more mobile than traditional desktop terminals and client terminals. The appeal of these new thin-clients is that they offer the potential for the user to send and receive electronic transactions and transmissions at virtually any time and from virtually anywhere. Many of these lower cost thin-clients access much of their processing and memory capacities on-line from remote servers via Internet connections. These thin-client devices include, but are not limited to: wireless pagers; wireless and tethered telephones; network computers; thin-client exercise machines; electronic books; public access kiosks such as automated teller machines, vending machines, airport information terminals and or public kiosks; hand-held personal digital assistants such as Palm Pilots™ and the like; on-line photocopy machines; automobile embedded Internet-connected appliances which download preferred radio stations, seat and temperature adjustments, and the like; thin-client household appliances such as refrigerators, microwaves, and the like; thin-client home entertainment appliances including on-line televisions such as WebTV™, portable digital audio systems such as the Rio™, along with their associated remote controls.
These two trends, of proliferating personal computing devices and of increased on-line communications usage, have led to a distinct problems: a) There is now the widespread use of electronic facsimiles, electronic mail messages and similar electronic communications which lack the proper identification of individuals for such electronic transactions and transmissions. The ease and speed of electronic communication, and its low cost compared to conventional mail, has made it a method of choice for communication between individuals and businesses alike. This type of communication has expanded greatly and is expected to continue to expand. However, millions of electronic messages such as facsimiles and electronic mail (or “E-mail” or “email”) messages are sent without knowing whether they arrive at their true destination or whether a certain individual actually sent or received that electronic message. Furthermore, there is no way to verify the identify the individual who sent or who received an electronic message, and; b) with so may personal computing devices, the user now has user-customized electronic data stored on multiple man-made memory devices, or “tokens”, which the user must manage and possess for storage, access, processing and presentation of their electronic transactions and transmissions. Further, if the user wants all of these new computing tokens to possess the same capabilities with respect to the user's personalized information and customized functions, then the user needs to frequently and redundantly enter all such user-customized data into each token. This is a cumbersome burden which most consumers eschew. If, on the other hand, the user does not effect such redundancies, then losing or damaging their primary personal computing token would be a severe blow. In this instance, or even in the instance where the user loses or damages a computing token with a subset of their information, then months, and perhaps years, of important personal and likely confidential electronic transactions and transmissions could be irretrievably lost, or revealed to an untrusted third-party.
In sum, the multitude of such personal computing tokens, whether unconnected desktop terminals or on-line hand held thin clients, has exacerbated the problem of user-reliance on particularly vulnerable, customized memory tokens which can be easily damaged, lost or stolen.
To protect these tokens and the resident electronic transactions and transmissions they contain, the use of various biometrics, such as fingerprints, hand prints, voice prints, retinal images, handwriting samples and the like have been suggested for identification of individuals. However, because the biometrics are generally themselves stored in electronic, and thus reproducible, form on the token itself and because the comparison and verification process is not isolated from the hardware and software directly used by the user attempting access, the problems of fraudulent access and of having to constantly carry these tokens is not alleviated. Further, such systems do not adequately isolate the identity verification process from tampering by someone attempting to gain unauthorized access. Examples of this approach to system security are described in U.S. Pat. Nos. 4,821,118 to Lafreniere; 4,993,068 to Piosenka et al.; 4,995,086 to Lilley et al.; 5,054,089 to Uchida et al.; 5,095,194 to Barbanell; 5,109,427 to Yang; 5,109,428 to Igaki et al.; 5,144,680 to Kobayashi et al.; 5,146,102 to Higuchi et al.; 5,180,901 to Hiramatsu; 5,210,588 to Lee; 5,210,797 to Usui et al.; 5,222,152 to Fishbine et al.; 5,230,025 to Fishbine et al.; 5,241,606 to Horie; 5,265,162 to Bush et al.; 5,321,242 to Heath, Jr.; 5,325,442 to Knapp; 5,351,303 to Willmore, all of which are incorporated herein by reference.
An example of a token-based security system which relies on a biometric of a user can be found in U.S. Pat. No. 5,280,527 to Gullman et al. In Gullman's system, the user must carry and present a credit card sized token (referred to as a biometrics security apparatus) containing a microchip in which is recorded characteristics of the authorized user's voice. In order to initiate the access procedure, the user must insert the token into a terminal such as a public kiosk, and then speak into the terminal to provide a biometrics input for comparison with an authenticated input stored in the microchip of the presented token. The process of identity verification is generally not isolated from potential tampering by one attempting unauthorized access. If a match is found, the remote terminal may then signal the host computer that access should be permitted, or may prompt the user for an additional code, such as a PIN (also stored on the token), before sending the necessary verification signal to the host computer.
Although Gullman's reliance of comparison of stored and input biometrics potentially reduces the risk of unauthorized access as compared to numeric codes, like personal identification numbers, Gullman's use of the token as the repository for the authenticating data combined with Gullman's failure to isolate the identity verification process from the possibility of tampering greatly diminishes any improvement to fraud resistance resulting from the replacement of a numeric code with a biometrics. Further, the system remains cumbersome and inconvenient to use because it too requires the presentation of a personalized memory token in order to initiate an access request.
Almost uniformly, prior art disclosing biometrics are token-based systems which teach away from biometrics recognition without user-dependence on personalized memory tokens. Reasons cited for such teachings range from storage requirements for biometrics recognition systems to significant time lapses in identification of a large number of individuals, even for the most powerful computers.
In view of the foregoing, there has long been a need for a computerized electronic transactions and transmissions system which enables the user to universally access, process and present their electronic transactions and transmissions with optimal convenience by not requiring the user to possess any man-made memory tokens on which must be stored the user's customized in order for the user to execute electronic transactions and transmissions. Further, there is a need for a tokenless computer system which is highly fraud-resistant, and which is centered around the individual themselves by relying solely upon their unique biometric samples. Such a system should be able to function for the user wherever and whenever the user may be using any generic on-line computing device, whether a desktop or a thin client, for conducting their electronic transactions and transmissions.
Further, there is a need for a computing system that provides the user with centralized storage, access, processing and presentation of their electronic transactions and transmissions regardless of whether the personal computing device the user is using possesses only a resident subset of their user-customized data or in fact possesses none of their user-customized data at all. Further, there is a need for a computerized electronic transactions and transmissions system that provides the user with the above benefits whether or not the personal computing device the user may be using at any given time contains powerful resident memory and processing capacities, or whether it contains virtually no resident memory and processing capacities. Further, there is a need for a computer system which relieves the user from having to redundantly data-enter and update a variety of individual personal computing devices in order to achieve the same customized performance from any or all of such devices.
There is also a need for a computerized electronic transactions and transmissions system which relieves the user from having to redundantly data-enter their personal demographics and customized Internet usage activity information into a variety of Internet web sites in order to achieve uniformly customized service at each such web sites. Additionally, there is a need for a computerized electronic transactions and transmissions system which enables a user to benefit from executing customized and complex commands governing their electronic transactions and transmissions regardless of whether the on-line computing device the user happens to be using is a high-powered desktop terminal or whether it is a hand-held, ultra thin-client terminal with virtually no resident computer processing or memory capabilities of its own.
There is also a need for an electronic transactions and transmissions system that uses a strong link to the person being identified, as opposed to merely verifying a user's possession of any physical objects that can be freely transferred.
There is a further need for an electronic transactions and transmissions system that ensures user convenience by enabling user-authorization without requiring the user to possess, carry, and present one or more proprietary memory tokens, such as man-made user-customized portable memory devices, in order to effect electronic transactions and transmissions. Anyone who has lost a smart card or a traditional notebook personal computer, left it at home, had it damaged or stolen knows well the keenly and immediately-felt inconvenience caused by such problems. Therefore, there is a need for an electronic biometric transactions and transmissions system that is entirely tokenless.
There is another need in the industry for a computerized electronic transactions and transmissions system that is sufficiently versatile to accommodate both users who desire to use personal identification codes (PICs), being alphabetical, numerical or graphical, for added security and also consumers who prefer not to use them.
Lastly, such a system must be affordable and flexible enough to be operatively compatible with existing networks having a variety of electronic transmission devices and system configurations.